Author: HackWatchit
Strata Identity introduced a new product, Identity Orchestration for AI Agents. Built on Strata’s Maverics vendor-agnostic identity fabric and hybrid air-gap architecture, it provides identity guardrails and observability for AI agents without limiting identity provider (IDP) choice. AI agents pose new identity challenges that traditional IAM can’t handle. These agents are ephemeral and autonomous, accessing enterprise data through MCP (Model Context Protocol). As a result, they operate across systems using opaque credential flows without persistent attributes, dynamic provisioning, or audit trails. In hybrid environments spanning clouds, on-prem systems, and multiple IDPs, this creates blind spots in governance, inconsistent access control,…
A recent investigation by VulnCheck has exposed a cryptomining campaign that has been running unnoticed for years. The threat actor behind this operation, using the Linuxsys miner, has been targeting vulnerable systems since at least 2021, maintaining a consistent strategy that relies heavily on compromised legitimate websites to distribute malware. What makes this campaign more difficult to detect is the attacker’s use of real websites as malware delivery channels. Instead of hosting payloads on suspicious domains, they compromise third-party sites with valid SSL certificates and plant their download links there. This not only helps them bypass many security filters but…
Perplexity AI, the generative AI search startup, has secured $100 million in new capital, boosting its valuation to $18 billion, Bloomberg reported. The deal extends a recent funding round that had previously valued the company at $14 billion and highlights the continued enthusiasm among investors for top-tier AI ventures. Founded in 2022, Perplexity has rapidly scaled, tripling its valuation several times over the past year. It has also been the source of reports that Apple is interested in acquiring the company. The firm had initially targeted an $18 billion valuation in March 2025 but settled for a smaller round at $14…
The U.S. House Committee on Homeland Security Subcommittee on Cybersecurity and Infrastructure Protection will hold a hearing next Tuesday to examine the evolution of threats to critical infrastructure following the discovery of Stuxnet 15 years ago. Witnesses listed for the hearing include Tatyana Bolton, executive director of the Operational Technology Cybersecurity Coalition (OTCC); Kim Zetter, cybersecurity journalist and author of ‘Countdown to Zero Day’; Robert Lee, CEO and co-founder of industrial cybersecurity firm Dragos; and Nate Gleason, program leader at the Lawrence Livermore National Laboratory, according to a copy of the notice. “Stuxnet signaled a new age in the targeting…
VMware fixed four vulnerabilities in VMware ESXi, Workstation, Fusion, and Tools that were exploited as zero-days during the Pwn2Own Berlin 2025 hacking contest in May 2025. Three of the patched flaws have a severity rating of 9.3, as they allow programs running in a guest virtual machine to execute commands on the host. These flaws are tracked as CVE-2025-41236, CVE-2025-41237, and CVE-2025-41238. These flaws are described in the security advisory as: CVE-2025-41236: VMware ESXi, Workstation, and Fusion contain an integer-overflow vulnerability in the VMXNET3 virtual network adapter. Nguyen Hoang Thach of STARLabs SG used this flaw at Pwn2Own. CVE-2025-41237: VMware ESXi, Workstation, and Fusion contain an integer-underflow in VMCI…
Security researchers recently revealed that the personal information of millions of people who applied for jobs at McDonald’s was exposed after they guessed the password (“123456”) for the fast food chain’s account at Paradox.ai, a company that makes artificial intelligence based hiring chatbots used by many Fortune 500 firms. Paradox.ai said the security oversight was an isolated incident that did not affect its other customers, but recent security breaches involving its employees in Vietnam tell a more nuanced story. A screenshot of the paradox.ai homepage showing its AI hiring chatbot “Olivia” interacting with potential hires. Earlier this month, security researchers…
GetBlock, a premium RPC node provider and Web3 infrastructure platform, has announced its first major achievement with region-specific shared APIs. Just two weeks after launch, GetBlock New York-based BNB Smart Chain (BSC) infrastructure cluster has become the fastest in the Americas. Fastest BSC RPC in the Americas: GetBlock reaches 21 ms latency in the US As of July 15, 2025, GetBlock’s BSC RPC APIs have reached a significant milestone in the Western Hemisphere. According to a recent report from CompareNodes, the platform outperformed all competitors in both North and South America in terms of latency.\ In North America, GetBlock’s BSC…
1. In one of my previous articles, we explored Google’s Titans (Behrouz et al., 2024)1 and how TTT (Test-Time Training) can be used to equip an LLM with a human-like, malleable memory, which can update its information at test time. Test-time training, as the name suggests, is a paradigm that lets the model update its parameters on unseen data. But at test time, there are no ground truth labels that can help steer the model in the right direction (because that would be overt cheating). Instead, it performs a task with the data (designed and baked into the model), which…
Cisco patches critical CVE-2025-20337 bug in Identity Services Engine with CVSS 10 Severity Pierluigi Paganini July 17, 2025 Cisco warns of CVE-2025-20337, a critical ISE flaw (CVSS 10) allowing remote code execution with root privileges. Cisco addressed a critical vulnerability, tracked as CVE-2025-20337 (CVSS score of 10), in Identity Services Engine (ISE) and Cisco Identity Services Engine Passive Identity Connector (ISE-PIC). An attacker could trigger the vulnerability to execute arbitrary code on the underlying operating system with root privileges. “Multiple vulnerabilities in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an unauthenticated, remote attacker…